VMware VI3 with security certification CC EAL 4+

[enetics]

I have a question about a security issue concerning VMware VI3. We maintain a server platform and some of the servers are not being used that much. These servers are perfect for being virtualized.

For writing a virtualization proposal we need to know if VMware Vi3 will be certified in the near future by the Common Criteria Evaluation and Validation Scheme CC EAL 4+. This security certification is needed for these servers that will be virtualized.

Does someone has more information about this certification and the ongoing CCEVS process. The information that we found is that VMware is trying to achieve this certification ( see http://www.cse-cst.gc.ca/services/common-criteria/ongoing-evals-e.html )

specially looking for the date the certification will be achieved. Will this certification be valid for Vi 3.01 or also for future releases (3.02, 3.5, ...)?

Thanks for your replies.

[Texiwill]

Hello,

Check out http://www.cse-cst.gc.ca/services/ccs/vmware-e.html for information on this.

Best regards,
Edward L. Haletky
VMware Communities User Moderator
====
Author of the book 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', Copyright 2008 Pearson Education.
Blue Gears and SearchVMware Pro Blogs -- Top Virtualization Security Links -- Virtualization Security Round Table Podcast

[surfup]

Edward,

Thanks for the link. However, the link is no longer active.

Cheers,

[admin]

BacMan,

Not just yet. I am working on getting a timeframe as to when this will be available.

[surfup]

Thanks for the info.

FYI, I pinged one of VMware sale rep for government, he told us expecting the completion for ESX 3.5 and VC 2.5 CC for 3rd of FY09 - end of September. But, since we, I, could not found anything that list ESX 3.5 and VC 2.5 are currently "under evaluation" I am a bit hestitate to believe it at this point - well, let wait and find out, shall we!

Cheers,

[EBetts]

VMware has submitted the required security evidence for the ESX35/VC25 CC cert @ EAL4+ to the government for review to obtain the "products in-evaluation" posting.

The materials have been accepted and the "products in-eval" posting is imminent.

[EBetts]

VMware ESX v3.5/vCenter 2.5 was posted to the "Products In-Evaluation" listing today.

Please note that as of today, the certification level is listed in-correctly as EAL3+ when it is really EAL4+. CSE has been contacted and this will be corrected as soon as possible.

I'll follow up once this update has been corrected.

[EBetts]

VMware's product in-evaluation certification level has been corrected. EAL4+ is correctly listed now.

http://www.cse-cst.gc.ca/its-sti/services/cc/oe-pece-eng.html

[surfup]

Thanks for the link and much appreciated. This is very good news for us who working in the DOD space.

Cheers,

[EBetts]

VMware ESXi 35 / VC 25 is now listed on the products in-evaluation at the same location: